MCP for Clinics: Questions to Ask Before You Connect

Before a clinic connects an AI assistant to its marketing data through MCP, get plain answers to seven questions: who hosts the server, what it can read, whether it can write or spend, which AI client and model vendor see the answers, whether each one signs a BAA, what is logged, and how you revoke access. Curve built its MCP server so each answer is short: it is hosted by Curve, returns only rounded weekly totals, cannot write, and logs every call, with a signed BAA on every plan. The catch applies to Curve too: a BAA covers only its signer, and your AI vendor is a separate hop.

The seven questions and their short answers

For the basics, see what MCP is. Then ask these of every connector. If a vendor cannot answer one in a sentence, that is your answer.

1. Who hosts the server? Know the company, the endpoint and the machine it runs on. "Open source" usually means you host it and you secure it.
2. What can it read? Everything the connected login can reach, unless the server narrows it. If that includes contacts, messages or appointment notes, treat it as a PHI system.
3. Can it write, send or spend? Google's official Google Ads and GA4 servers are read-only. The Meta, TikTok, Amazon Ads, HubSpot and HighLevel servers can change things.
4. Which AI client and model vendor see the answers? Every tool result goes into the model's context. The model vendor is a recipient, not a bystander.
5. Is there a BAA for each hop? Often no. Google and Meta do not sign BAAs for their advertising products, and no single agreement covers the whole chain.
6. What is logged? Someone must be able to show who asked what, which tool ran and what came back.
7. How do you revoke access? Know the switch, who holds it and every token that exists, before you connect.

Where the server runs and what it can touch

1. Who hosts the server

MCP servers come in two shapes. A local server is a program the AI app starts on someone's computer, signed in with whatever credentials are saved there. A remote server is an HTTPS endpoint the vendor runs, such as Meta's at mcp.facebook.com/ads, HubSpot's at mcp.hubspot.com or HighLevel's at services.leadconnectorhq.com.

"Official" does not mean hosted. Google's Google Ads MCP server is open-source code you run yourself, locally or on your own Cloud Run deployment, signed in with your OAuth credentials or a google-ads.yaml file plus a developer token. If it runs on a staffer's laptop, that laptop holds a working key to your ad account.

Good answer: a named company, a named endpoint, and a credential you can scope, expire and revoke, such as the OAuth sign-in Meta and HubSpot use.

Stop if: the server is a repository from a developer nobody can name. Security researchers have shown that a server can hide instructions to the AI inside its tool descriptions, where you never see them.

2. What it can read

By default, an MCP server reads whatever the connected account can see. Google's Ads server runs GAQL queries, so it reaches campaigns, keywords, conversions, spend and search terms, which in a clinic account can name the condition.

CRM connectors are more serious. HighLevel's earlier MCP tool list includes calendars_get-appointment-notes, conversations_get-messages and payments_list-transactions. Its current v2 server replaces them with four generic tools, and execute_operation runs whatever the OAuth scopes you approved allow, so the consent screen is the real tool list. If your clinic runs patient intake through that CRM, either version hands PHI to whichever AI asked.

HubSpot's server reaches whatever the connecting user can see, including contacts, appointments and conversations. It blocks activity and conversation data (calls, emails, meetings, notes, tasks) once Sensitive Data is on, a setting only its Enterprise plans offer. Contact records are not on that blocked list.

Good answer: the tool list by name, or the exact scopes behind a generic tool, and which fields each returns. HIPAA's minimum necessary standard asks for reasonable efforts to limit PHI to what the task needs, and "how many leads did we get last week" does not need a single name.

Stop if: the answer is "whatever your account can see" and your account holds patient records.

3. Whether it can write, send or spend

Read-only is the exception. Google calls its Google Ads server "strictly read-only": it cannot modify bids, pause campaigns or create assets, and the GA4 server takes read requests only.

Meta's ads MCP server, still in beta, can create campaigns, ad sets, ads and creatives, and can create, update or delete custom audiences. New campaigns and ads start paused, and the AI client asks for confirmation before ads_activate_entity sets anything live and starts spending. That pause does nothing for audiences, or for budget and targeting edits to live ad sets through ads_update_entity. A custom-audience tool is also a route for a patient list to reach Meta.

TikTok's server can change budgets and bids, and Amazon's can create, update and delete campaigns. CRM write access touches patients directly: HighLevel's earlier tools include conversations_send-a-new-message, so an assistant can message a contact.

Good answer: read-only by the server's own documentation, or write tools switched off at the source. Meta lets you restrict an agent to read-only, approval-required or full access, per asset or in bulk.

Stop if: your only evidence is a read-only label in the AI client. That label (readOnlyHint in the MCP spec) is only a hint, defaults to false, and is untrusted unless the server is.

Who else sees the answers

4. Which AI client and model vendor see the answers

An MCP connection has at least three parties: the server, the AI client you type into (Claude, ChatGPT, Cursor, Claude Code), and the company running the model. Every tool result lands in the model's context. Google's repository says it plainly: the server "will expose your data to the Agent or LLM that you connect to it."

The plan matters as much as the brand. Only Claude Enterprise plans can enable Anthropic's HIPAA readiness; Team, Free, Pro and Max cannot. OpenAI offers no BAA for ChatGPT Business, only for sales-managed enterprise and healthcare offerings.

Good answer: a named client, a named plan and a company-owned account.

Stop if: a coordinator connected the CRM to a personal Pro subscription to try it out.

5. Whether there is a BAA for each hop

Answer the BAA question hop by hop. Google says outright that it "does not offer Business Associate Agreements" for Google Analytics, and Meta's Business Tools Terms tell advertisers not to share health information at all. HubSpot signs a BAA on qualifying Enterprise plans, but it covers only services HubSpot has explicitly authorized for PHI, and we could not find a HubSpot statement placing its MCP server in that group.

The AI hop has its own gap. Anthropic's BAA page says MCP connectors can be used on HIPAA-ready Enterprise plans, but data sent to third parties through them is not covered by Anthropic's BAA. On the Claude API, the MCP connector is not HIPAA-eligible at all.

For most ad and analytics connectors, the BAA question has no good answer. The safer design keeps person-level data from reaching that hop at all. Curve's server is built that way: it releases only rounded weekly totals, with small groups withheld. For what a signed agreement binds, read what a real BAA covers.

Good answer: a signed BAA wherever PHI can flow, and a written reason why none can flow everywhere else.

Stop if: someone says the AI tool "is HIPAA compliant" or "is covered by our BAA" without naming the plan, the signed agreement and whether connectors are on its list of covered features.

What happens after you connect

6. What gets logged

The MCP spec says clients should log tool usage for audit purposes. "Should" is not "must", so check what your client actually records. HIPAA's audit controls standard expects systems that contain or use electronic PHI to record and examine activity.

Records can live in the client's chat history, the server's call log and the data vendor's API log. The chat history is also a copy of every answer, kept under the AI vendor's retention rules, so the answers should hold no PHI.

Good answer: every call recorded with the user, the tool, the inputs and what came back, readable by someone at the clinic. Our guide to MCP audit logs covers what to keep.

Stop if: the logging plan is "we can scroll back through the chat."

7. How you revoke access

Revoking MCP access is rarely one switch. Working credentials can include an OAuth grant at the data vendor, a HighLevel Private Integration Token pasted into a config file, a google-ads.yaml file on a laptop, and the connector entry in the AI client. Remove one and the others keep working.

The MCP spec's security guidance warns that anyone holding a token stored by the client, or cached or logged on the server, can make requests "that appear legitimate", and it tells authorization servers to issue short-lived tokens. Expiry is your backstop for the token nobody remembers creating.

Good answer: one named person can switch access off for everyone, tokens expire on their own, and someone is notified when a new one is issued. Our guide to MCP token scopes and expiry goes deeper.

Stop if: nobody can list every token that exists and who created it. Run that test the day a staffer or an agency leaves.

How Curve MCP answers the seven questions

Curve MCP lets an AI assistant query a clinic's campaign and website reporting as completed weekly figures. Its answers, in order:

1. Host. Curve hosts and runs the server, under a dedicated database role that cannot read contact details, form answers or journeys. The service checks that restriction every time it starts.
2. Reads. Organization-level figures only: visitors, sessions, goal completions and funnel steps, for completed weeks over fixed look-backs of 1, 4, 13 or 52 weeks. It reconciles your server-side campaigns: each campaign's platform-reported spend, clicks and impressions sit next to the conversions Curve's server-side tracking recorded, with cost per conversion by completed week, and one link opens the full sent, accepted and matched view inside Curve. No revenue, ROAS, form data, or channel, device, region or page breakdowns. Unapproved goal, funnel and campaign names read "(label hidden)".
3. Writes. None. Every tool reads; none changes your data or accounts.
4. AI vendor. Your choice, and not a Curve subprocessor. It works with any client or agent that can connect to an MCP server, including Claude (desktop, web and Claude Code), ChatGPT and Cursor. Because the vendor sees every answer, each one is shaped before it is sent.
5. BAA. Curve signs a BAA on every plan. It covers Curve, not the AI vendor you connect.
6. Logs. Every call is logged, and if the log cannot be written, no data is returned. Calls that returned data are kept for years.
7. Revocation. MCP is off by default for every user. Only the clinic's primary user can turn it on for the organization, and turning it off removes everyone's access at once. Tokens are scoped and expire, issuing one requires a confirmation code, and admins are notified.

Shaping works like this: people are counted rather than visits, small groups are withheld, counts and spend are rounded, and a number that could reveal a small group by subtraction is withheld too. A final guard checks each response for anything that looks like an email, phone number, ID, date or name, and blocks the whole answer if it finds one or cannot run.

Two limits are deliberate. Figures can trail the dashboard by up to a week, because the current week is never included. Questions about individual people get an "open in Curve" link into Curve Analyst instead of an answer; the link needs a login, works once, expires quickly and carries no data. For why small groups are withheld, see how small-group rules work.

Anthropic's documentation conflicts on whether Claude Code is covered by its HIPAA program, so confirm your client's coverage in writing.

Frequently asked questions

What if someone on staff already connected an MCP server without asking?

Treat it as an incident, not a scolding. Revoke the grant at the data vendor and remove the connector from the AI client, then read the chat history to see what actually came back. If contact records or messages reached an AI vendor with no BAA, hand it to whoever runs your privacy incidents.

What should we get in writing before connecting?

The seven answers, from the vendor: the tool list or scopes, the read-only status in its own documentation, the signed BAA or a written statement that no PHI can flow, where calls are logged, and how access is revoked. Add the AI client, plan and account you will use, and who approved it.

Does a Claude or ChatGPT enterprise BAA cover our MCP connectors?

Not for the data that leaves through them. Anthropic says data sent to third parties through MCP connectors is outside its BAA, and OpenAI describes custom MCP connectors as not verified by OpenAI. Treat an enterprise BAA as covering only the vendor's listed features, and judge each connector separately. Our Claude BAA breakdown covers the Anthropic side.

Can our agency connect our accounts to its own AI assistant?

Only if the agency answers the same seven questions for its own setup. Its AI subscription is another party, and your BAA with the agency does not automatically reach the model vendor it chose. See agency BAA obligations.

How often should we re-ask these questions?

Whenever the chain changes: a new server version, tool, AI client, staff member or agency. A server can change its tool descriptions after you approve it (researchers call this a rug pull). Review quarterly at minimum.

Do I need a compliance officer to answer these?

No. An owner or marketing lead can put all seven to a vendor on a sales call. The person who signs your BAAs should still approve the connector, and the compliance officer checklist gives them the deeper version.

Where to start

Write one page per connector with the seven answers before anyone connects it. Start with read-only servers over data that holds no people, such as campaign spend and clicks, and leave CRM connectors for last. Run the free compliance scanner to see what your website already sends to ad platforms, because an AI connector will not fix a pixel that is leaking today.

If you want AI answers about campaign performance without patient data in the chain, book a demo and we will walk through its answer to each of the seven questions. Curve provides server-side tracking, attribution and analytics for healthcare, with a signed BAA on every plan.

Reviewed September 2026 against each vendor's public documentation. MCP servers change often, so re-check the tool list before you connect.